CVE-2023-39322

Memory exhaustion in QUIC connection handling in crypto/tls

State: Published
Severity: Not scored
Published: Sep 8, 2023
Updated: Feb 13, 2025
Reserved: Jul 27, 2023

Description

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
crypto/tlsGo standard library	1.21.0-0 to before 1.21.1Affected

References

https://go.dev/issue/62266
https://go.dev/cl/523039
https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
https://pkg.go.dev/vuln/GO-2023-2045
https://security.netapp.com/advisory/ntap-20231020-0004/
https://security.gentoo.org/glsa/202311-09

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.